Abstract Class: BaseAuthLogoutRoute
Defined in: src/routes/BaseAuthLogoutRoute.ts:42
Clears the authentication cookie previously set by a successful sign-in (see TokenUtils/auth:cookie
configuration). Model-agnostic and shared across every authentication strategy, since logging out isn't
specific to how the caller originally authenticated.
A no-op (still returns success) when cookie issuance isn't enabled, or the caller was never issued one —
a client that only ever used the Authorization: Bearer header has nothing here to clear, and simply
discards its own token locally.
This does not invalidate the JWT itself — a bearer token already issued remains valid until its natural
expiry even after this call succeeds; deployments needing server-side revocation must add a token
blocklist/short-lived-token strategy on top of this. It does, however, invalidate the session-bound
refresh token (see BaseAuthRefreshRoute): without clearing req.session.userUid/refreshUid here, a
refresh token leaked before logout (e.g. a narrow XSS window, a synced device) would remain fully usable
to silently mint new sessions until the session's own independent TTL eventually expired, long after the
user believed they'd logged out.
Example
import { BaseAuthLogoutRoute } from "@rapidrest/auth";
import { RouteDecorators } from "@rapidrest/service-core";
const { ApiRoute } = RouteDecorators;
@ApiRoute("/auth/logout")
export class AuthLogoutRoute extends BaseAuthLogoutRoute {}
Constructors
Constructor
new BaseAuthLogoutRoute():
BaseAuthLogoutRoute
Returns
BaseAuthLogoutRoute
Properties
tokenUtils?
protectedoptionaltokenUtils?:TokenUtils
Defined in: src/routes/BaseAuthLogoutRoute.ts:44
Methods
logout()
logout(
req,res):Promise<void>
Defined in: src/routes/BaseAuthLogoutRoute.ts:53
Parameters
req
HttpRequest
res
HttpResponse
Returns
Promise<void>